CVE-2024-38526 pdoc embeds link to malicious CDN if math mode is enabled

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

CVE-2024-38526

The pdoc Python library for API documentation is affected by a supply chain attack where documentation generated with pdoc --math linked to malicious JavaScript files from the compromised polyfill.io CDN. This issue is fixed in pdoc version 14.5.1 . Several security tools, including pollyscan and...

CVE-2024-27602

Alldata version V0.4.6 is affected by an Incorrect Access Control vulnerability that leads to the leakage of interface documents for multiple modules. Specifically, the /api/system/v2/api-docs module is exposed, potentially revealing sensitive internal technical details. To minimize risk, it is r...

CVE-2024-27602

Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module...

Malware in yield-api-documentation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-20 Malicious code in yield-api-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd5cbdb7d4a993fa1eaa24b6a76752bcaef2b40f325168ed535651ab0b116a48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-Q63Q-HWF6-3MW6 ONOS vulnerable to Cross-site Scripting

A cross-site scripting XSS vulnerability in Open Network Operating System ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the authorizationURL parameter of the API documentation dashboard under securityDefinitions...

CVE-2023-30093

A cross-site scripting XSS vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard...

Cross site scripting

A cross-site scripting XSS vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard...

CVE-2023-30093: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard...

CVE-2023-30093

A cross-site scripting XSS vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard...

CVE-2023-30093

A cross-site scripting XSS vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard...

CVE-2023-30093

CVE-2023-30093 is a cross-site scripting (XSS) vulnerability affecting Open Networking Foundation ONOS, from version v1.9.0 through v2.7.0. The issue enables execution of arbitrary web scripts/HTML via a crafted payload injected into the url parameter of the API documentation dashboard. The provi...

PT-2023-22535 · Open Networking Foundation · Onos

Name of the Vulnerable Software and Affected Versions: Open Networking Foundation ONOS versions 1.9.0 through 2.7.0 Description: A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter or...

CVE-2023-30093

A cross-site scripting XSS vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard...

GHSA-6RFV-H5V8-CJ7G jeecg-boot vulnerable to improper authentication

A vulnerability was found in jeecg-boot 3.5.0 that affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication because the software does not prove or insufficiently proves that an identity claim is correct when an actor claims to have a...

jeecg-boot vulnerable to improper authentication

A vulnerability was found in jeecg-boot 3.5.0 that affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication because the software does not prove or insufficiently proves that an identity claim is correct when an actor claims to have a...

Authentication flaw

A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be...

CVE-2023-1784 jeecg-boot API Documentation improper authentication

A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be...

CVE-2023-1784 jeecg-boot API Documentation improper authentication

A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be...